Malicious AGENTS.md in Downloads Can Trick AI Coding Agents Into Installing Malware

Overview

• Forever Security discovered a live AGENTS.md on a customer’s machine that attempted to make an AI agent install the npm package function-color, which is linked to the MALFEX malware campaign.
• The company published its findings Monday and reproduced the chain against popular tools, with OpenAI Codex executing the payload in about 90% of tests and Anthropic’s Claude Code following malicious settings changes in roughly 50% of trials.
• The attack works because many browsers save files to ~/Downloads without prompting and agents are designed to load and obey plain-text project instruction files in their working directory.
• A malicious instruction file can also change an agent’s API endpoint to an attacker-controlled server and capture the session’s OAuth/login token, enabling account takeover without running additional code.
• Vendors and researchers say the fix is behavioral: do not start agents in Downloads, inspect or remove unknown AGENTS.md/CLAUDE.md files, keep approval prompts and sandboxes on, scope agents to project folders, and rotate credentials if a planted file is found.